Roadmap: Add automated offboarding workflow with approval gates

[afkpal]

Summary

Extend the agent with a guided offboarding workflow that walks an engineer through the full InhouseCIO offboarding sequence (reset password, revoke sessions, remove MFA, convert mailbox to shared, backup OneDrive, remove from groups/DLs, remove device from Intune, remove license, disable/delete account, update ticket).

Why

Offboarding is one of the highest-risk operations in regulated (SEC/FINRA) client environments. Today the Compliance Guard checks individual risky actions; a dedicated end-to-end workflow with explicit approval gates before irreversible steps would reduce mistakes further and keep a human in control.

Acceptance criteria

• Step-by-step offboarding topic triggered by natural language (e.g. "offboard a user")
• Approval gate before any irreversible action (account deletion, license removal)
• Pulls client-specific retention rules from the Client Profiles list
• Logs each completed step for ticket documentation

Notes

Responsible-AI aligned: advise + recommend, never silently execute irreversible changes.